claudetools/wiki/clients/cascades-tucson.md

---
type: client
name: cascades-tucson
display_name: Cascades of Tucson
last_compiled: 2026-07-15
compiled_by: HOWARD-HOME/claude-main
sources:
  - session-logs/2026-03-24-session.md
  - session-logs/2026-03-31-session.md
  - session-logs/2026-04-01-session.md
  - session-logs/2026-04-16-session.md
  - session-logs/2026-04-16-howard-client-docs-import.md
  - session-logs/2026-04-17-session.md
  - session-logs/2026-04-17-howard-session.md
  - session-logs/2026-04-18-session.md
  - session-logs/2026-04-20-session.md
  - session-logs/2026-04-20-mac-session.md
  - session-logs/2026-04-21-mac-vault-setup.md
  - session-logs/2026-04-21-howard-remediation-vault-gap.md
  - session-logs/2026-04-28-session.md
  - session-logs/2026-04-29-session.md
  - session-logs/2026-04-30-session.md
  - session-logs/2026-05-01-session.md
  - session-logs/2026-05-01-howard-syncro-billing-batch-and-tmp-path-incident.md
  - session-logs/2026-05-10-session.md
  - session-logs/2026-05-18-session.md
  - session-logs/2026-05-18-howard-billing-review-and-ticket-updates.md
  - session-logs/2026-05-20-session.md
  - session-logs/2026-05-21-session.md
  - session-logs/2026-05-23-session.md
  - session-logs/2026-05-24-GURU-KALI-session.md
  - clients/cascades-tucson/session-logs/2026-05-22-session.md
  - session-logs/2026-05-26-howard-session.md
  - clients/cascades-tucson/session-logs/2026-06-02-howard-efax-scanner-ticket.md
  - clients/cascades-tucson/session-logs/2026-06-03-session.md
  - clients/cascades-tucson/session-logs/2026-06-04-howard-email-delivery-investigation.md
  - clients/cascades-tucson/session-logs/2026-06-04-howard-caregiver-laptop-enrollment.md
  - clients/cascades-tucson/session-logs/2026-06-04-session.md
  - clients/cascades-tucson/session-logs/2026-06-05-session.md
  - clients/cascades-tucson/session-logs/2026-06-05-howard-cascades-entra-ticket-billing.md
  - clients/cascades-tucson/session-logs/2026-06/2026-06-08-howard-edge-unc-download-bug-diagnosis.md
  - clients/cascades-tucson/session-logs/2026-06/2026-06-10-howard-meredith-locked-word-doc.md
  - clients/cascades-tucson/session-logs/2026-06/2026-06-12-howard-shared-mailboxes-grievances-surveys.md
  - clients/cascades-tucson/session-logs/2026-05-16-howard-wireless-diagnostic.md
  - clients/cascades-tucson/session-logs/2026-06/2026-06-15-howard-cascades-wifi-rf-audit.md
  - clients/cascades-tucson/session-logs/2026-06/2026-06-15-howard-cs-server-raid-vpn-reset.md
  - clients/cascades-tucson/session-logs/2026-06/2026-06-16-howard-vertical-voice-vlan-plan.md
  - clients/cascades-tucson/docs/network/voice-vlan-cutover.md
  - clients/cascades-tucson/docs/network/voice-phone-inventory.md
  - clients/cascades-tucson/docs/network/network-logging-plan.md
  - clients/cascades-tucson/session-logs/2026-06/2026-06-18-howard-voice-vlan-migration-logging-plan.md
  - clients/cascades-tucson/reports/2026-06-16-unifi-full-audit.md
  - clients/cascades-tucson/reports/2026-06-16-2.4ghz-remediation-runbook.md
  - clients/cascades-tucson/docs/overview.md
  - clients/cascades-tucson/docs/network/topology.md
  - clients/cascades-tucson/docs/network/vlans.md
  - clients/cascades-tucson/docs/servers/cs-server.md
  - clients/cascades-tucson/docs/billing-log.md
  - .claude/memory/project_cascades_admin_accounts.md
  - .claude/memory/project_cascades_ca_phased_rollout.md
  - .claude/memory/project_cascades_pilot_cleanup.md
  - .claude/memory/feedback_syncro_cascades_contact.md
  - .claude/memory/feedback_cascades_user_security_group.md
  - .claude/memory/project-cascades-migration-plan.md
  - .claude/memory/feedback_cascades_folder_redirect.md
  - .claude/memory/howard-home-lan-shadow.md
  - clients/cascades-tucson/session-logs/2026-06/2026-06-17-howard-kpi-dashboard-scoping.md
  - clients/cascades-tucson/docs/proposals/kpi-dashboard.md
  - clients/cascades-tucson/docs/proposals/kpi-dashboard-onepager.md
  - .claude/memory/project_cascades_kpi_dashboard.md
  - clients/cascades-tucson/session-logs/2026-06/2026-06-17-howard-cascades-poly-phone-drops-network-smoothing.md
  - clients/cascades-tucson/session-logs/2026-06/2026-06-17-howard-cascades-power-outage-recovery-and-5ghz.md
  - clients/cascades-tucson/session-logs/2026-06/2026-06-17-howard-cs-server-drive-review-and-spike-question.md
  - clients/cascades-tucson/session-logs/2026-06/2026-06-17-howard-voice-vlan30-build.md
  - clients/cascades-tucson/session-logs/2026-06/2026-06-18-howard-cascades-outage-followup-openvpn-printer.md
  - clients/cascades-tucson/session-logs/2026-06/2026-06-18-howard-synology-drive-sync-diagnosis.md
  - clients/cascades-tucson/session-logs/2026-06/2026-06-18-howard-lupesanchez-desktop-trcieja-perf-diag.md
  - clients/cascades-tucson/session-logs/2026-06/2026-06-18-howard-cascades-rf-voice-optimization-plan.md
  - clients/cascades-tucson/docs/network/network-optimization-master-plan.md
  - clients/cascades-tucson/docs/network/phase1-voice-qos-design.md
  - clients/cascades-tucson/reports/2026-06-18-voice-quality-diagnostic.md
  - clients/cascades-tucson/session-logs/2026-06/2026-06-18-howard-memcare-baseline-and-change-window.md
  - clients/cascades-tucson/session-logs/2026-06/2026-06-19-howard-2am-rf-run-phase2b-applied.md
  - clients/cascades-tucson/session-logs/2026-06/2026-06-19-howard-5ghz-attempt-and-rollback.md
  - clients/cascades-tucson/session-logs/2026-06/2026-06-19-howard-5ghz-dfs-datadriven-applied.md
  - clients/cascades-tucson/session-logs/2026-06/2026-06-19-howard-cascades-rf-night-capstone.md
  - clients/cascades-tucson/session-logs/2026-06/2026-06-19-howard-voice-vlan-migration-complete-and-vertical-handoff.md
  - clients/cascades-tucson/docs/network/2026-06-19-vertical-5ghz-lock-request.md
  - clients/cascades-tucson/docs/runbooks/2026-06-23-planned-power-outage.md
  - clients/cascades-tucson/session-logs/2026-06/2026-06-23-howard-cascades-planned-outage-shutdown-verify.md
  - clients/cascades-tucson/docs/REMAINING-WORK-PLAN.md
  - clients/cascades-tucson/session-logs/2026-06/2026-06-24-howard-carf-technology-plan.md
  - clients/cascades-tucson/session-logs/2026-06/2026-06-24-howard-csc-ent-voice-helpany-consolidation-plan.md
  - clients/cascades-tucson/session-logs/2026-06/2026-06-25-howard-synology-skill-verify-fixes.md
  - clients/cascades-tucson/session-logs/2026-06/2026-06-25-howard-alma-offboarding-recovery-verify.md
  - clients/cascades-tucson/docs/security/offboarding-2026-06-25-alma-montt.md
  - clients/cascades-tucson/session-logs/2026-06/2026-06-25-howard-edr-rollout-bitdefender-removal.md
  - clients/cascades-tucson/session-logs/2026-06/2026-06-25-howard-cs-server-smb-migration-diagnosis.md
  - clients/cascades-tucson/session-logs/2026-06/2026-06-26-howard-cs-server-datto-removal-smb-rootcause.md
  - clients/cascades-tucson/session-logs/2026-06/2026-06-26-howard-edr-bd-straggler-9am-pass.md
  - clients/cascades-tucson/session-logs/2026-06/2026-06-26-howard-home-to-pro-upgrades-continued.md
  - clients/cascades-tucson/session-logs/2026-06/2026-06-29-howard-alis-caregiver-phoneonly-caretaker-crosscheck.md
  - clients/cascades-tucson/session-logs/2026-06/2026-06-30-howard-caregiver-phone-sso-license-onboarding.md
  - clients/cascades-tucson/session-logs/2026-06/2026-06-30-howard-tamra-matthews-offboarding.md
  - clients/cascades-tucson/session-logs/2026-06/2026-06-30-howard-vlan20-printer-migration.md
  - clients/cascades-tucson/session-logs/2026-06/2026-06-24-howard-ticket-review-and-cascades-consolidation.md
  - clients/cascades-tucson/session-logs/2026-06/2026-06-30-howard-alis-sso-login-model-recall.md
  - clients/cascades-tucson/session-logs/2026-07/2026-07-01-howard-vlan20-migration-live-reconcile.md
  - clients/cascades-tucson/docs/printer-gpo-map.md
  - .claude/memory/project_cascades_vlan20_migration_routing.md
  - clients/cascades-tucson/session-logs/2026-07/2026-07-01-howard-caretaker-roster-update-phone-login-cutover.md
  - clients/cascades-tucson/reports/2026-07-01-caretaker-roster-update.md
  - clients/cascades-tucson/docs/cloud/caretaker-phones-only-list.md
  - clients/cascades-tucson/session-logs/2026-07/2026-07-02-howard-caretaker-phone-login-pso-roster-cleanup.md
  - clients/cascades-tucson/session-logs/2026-07/2026-07-02-howard-shelby-webdocs-share.md
  - clients/cascades-tucson/session-logs/2026-07/2026-07-09-howard-charity-menle-caregiver-rename.md
  - clients/cascades-tucson/session-logs/2026-07/2026-07-09-howard-chris-knight-accounting-mailbox.md
  - .claude/memory/reference_rmm_map_network_drive.md
  - clients/cascades-tucson/session-logs/2026-07/2026-07-14-recovered-wiki-plan-review-hipaa-gaps.md
  - clients/cascades-tucson/session-logs/2026-07/2026-07-15-howard-technology-plan-final.md
  - clients/cascades-tucson/docs/proposals/cascades-technology-plan-2026-07-15.md
  - clients/cascades-tucson/docs/cloud/m365.md
  - session-logs/2026-07/2026-07-15-mike-taylen-uisp-cascades-techplan.md
backlinks:
  - projects/gururmm
  - wiki/systems/uos-server
---

# Cascades of Tucson

Senior living / assisted living facility in Tucson, AZ (201 N Jessica Ave, 85710). Single 6-floor building plus a MemCare (Memory Care) wing on floors 5-6. ~236 rooms. ACG took over from a previous MSP. Primary compliance driver is HIPAA. Active multi-phase migration project: domain join / VLAN 20 staff-machine move largely complete (22 machines migrated, ~6 stragglers), printer re-IP/GPO work is the lagging piece. Caregiver phone SSO Entra/identity side complete as of 2026-07-01 (35-member roster, licensed, CA cutover live). CARF Technology and System Plan finalized and delivered 2026-07-15.

---

## 2026-07-08 GPS-RMM reconciliation

GPS is billed via a counter tied to the number of Syncro assets (not a fixed device qty). Currently 29 on the GPS line / 32 in GuruRMM; reconciles through the asset counter, not a discrepancy (Winter/Mike, 2026-07-08).

---

## Entra Access Architecture (canonical overview)

**In one line:** a HIPAA-driven, identity-based access-control system that splits staff into two security postures and enforces them with **Microsoft Entra Conditional Access** on top of **hybrid identity** (Entra Connect), with **ALIS (clinical EHR) wired for SSO**.

### Foundation -- hybrid identity
- On-prem AD `cascades.local` synced to Entra/M365 via **Entra Connect** (PHS + Seamless SSO). UPN suffix `cascadestucson.com`, so a user's **Windows login = email = M365/ALIS identity** (one credential everywhere).

### Two user buckets (the core design)
1. **Restricted -- caregivers + medtechs** (group `SG-Caregivers`, `8b8d9222`): sign in **only on the Cascades network** and **only on approved devices** (shared Galaxy phones + a set of caregiver laptops/desktops). **No MFA** (no personal devices) -- protected by **location + device** controls + 8h sign-in frequency instead.
2. **Privileged -- admins / directors / managers / nurses** (NOT in `SG-Caregivers`): email + ALIS **from anywhere**, **seamless onsite / 2FA offsite** (Authenticator/PIN). Untouched by the caregiver lockdown.

### Conditional Access enforcement (caregivers)
- `CSC - Block caregivers off Cascades network` (`e35614e1`)
- `CSC - Block caregivers on non-compliant device` (`ede985e2`) -- **DISABLED 2026-07-01** (superseded by allow-list at final lockdown; do not re-enable)
- `CSC - Caregivers: allow-listed devices only` (`1b7fd025`): phones (`displayName -startsWith "CSC-"`) + tagged caregiver machines (`extensionAttribute1 -eq "CSCCaregiverDevice"`, or explicit deviceId). Still report-only / TEST-group scoped.
- `CSC - Caregiver sign-in frequency 8h` (`7d491c7a`)
- **[FIXED 2026-07-01]** `Require MFA for all users` (`7e87a1c7`) now excludes BOTH `SG-Caregivers-Pilot` and live `SG-Caregivers` (`8b8d9222`); break-glass excludeUsers preserved.
- Rollout is **per-user via group membership** (test group `SG-Caregivers-DeviceTest` `db5849ec` for one-at-a-time validation).
- **Caregiver Named Location:** trusted IPs `72.211.21.217/32`, `184.191.143.62/32`; live since 2026-04-29. CA location ID `061c6b06-b980-40de-bff9-6a50a4071f6f`.

### Devices
- **Phones:** Samsung A15s in Intune **Shared Device Mode** (Android Enterprise, corporate-owned dedicated). Enrollment profile: `CSC - Android Shared Phones (Entra SDM)` (`9a0fcc6d`). Dynamic group: `Cascades - Shared Phones` (`ea96f4b7`), rule `(device.enrollmentProfileName -startsWith "CSC - Android Shared Phones")`. **NEVER create a new enrollment profile** -- a differently-named profile falls outside the group rule. Reuse the existing profile's QR. Android enrollment token: `clients/cascades-tucson/intune-android-enrollment-token.sops.yaml` (expiry ~2091; treat `tokenExpirationDateTime` as a claim, not a fact -- use **Replace**, not Revoke, when the token goes stale).
- **Laptops/desktops:** caregiver shared machines (Laptop2, LAPTOP-DRQ5L558, LAPTOP-E0STJJE8, ASSISTNURSE-PC, NURSESTATION-PC) joined to Entra via Hybrid Entra Join; CA allow-list targets group `Cascades - Caregiver Devices` (`02c6f698`).
- **Managed Google Play binding:** owned by `MDMS@cascadestucson.com` -- if this account is deleted/disabled/unlicensed, every Android phone loses management. Vault: `clients/cascades-tucson/mdm-service-account.sops.yaml`.

### ALIS SSO
- Entra app registration -> OIDC SSO into ALIS; **tenant-wide admin consent granted** 2026-06-03 (`AllPrincipals` `User.Read` on SP `e1cae4ad`). Per-caregiver: ALIS staff `Email` must equal Entra UPN exactly. Caregivers SSO silently on phones (ALIS-native 2FA off); office users SSO with offsite MFA. ALIS application: `d5108493-cba8-4f08-90b6-1bb0bc09eb2a`, daily sign-ins verified 2026-07-15.
- **How to enable ALIS SSO for one user:** set **Email = exact Entra UPN** in ALIS admin -> Staff -> record; user signs in via "Sign in with Microsoft"; turn off ALIS-native 2FA (native 2FA conflicts and locked out Karen Rossini). No local ALIS password needed for SSO users.

### Caregiver phone SSO -- current state (as of 2026-07-15)
- **Entra/identity side COMPLETE** for the current 35-member `SG-Caregivers` roster. All 35 licensed Business Premium; forced-change flag cleared fleet-wide 2026-07-02 (temp passwords now valid for phone sign-in). Temp passwords vaulted: `clients/cascades-tucson/caregiver-temp-passwords-2026-06-30.sops.yaml` (40 initial) + `clients/cascades-tucson/caregiver-temp-passwords-2026-07-01.sops.yaml` (4 new hires). Retrieve with `vault get` (NOT `get-field` -- dotted keys). Do NOT inline values.
- **Remaining gate (ALIS side, Howard handling):** set each caregiver's ALIS staff `Email` = Entra UPN. Outstanding: 7 no-ALIS-record caregivers (need ALIS records built via `alis` skill `build-import` -> upload .xls in ALIS UI); Munezero/Cota/Robinson ALIS records needed; Vallejo Email=UPN; 5 Med Techs revisit; 7 discharged-record reactivate-vs-recreate decisions.
- **Interim CA posture (2026-07-01, Howard):** caretakers sign in on desktops AND phones, on-network only. Phones-only lockdown deferred to end of rollout; tracking list `docs/cloud/caretaker-phones-only-list.md`.
- **[RULE] Caregiver phone onboarding:** never set `ChangePasswordAtLogon $true` for a caregiver who will sign in on a shared phone -- it always fails as Entra `err=50126` (`Microsoft Authentication Broker` cannot render the forced-change screen). Diagnose: pull sign-in logs (unfiltered `?$top=50`, grep client-side) + check `pwdLastSet`/`PasswordExpired` on CS-SERVER.
- **`SG-Caregivers` is frontline caregivers ONLY.** Admin-adjacent staff (Feller, Nyanzunda), `pilot.test`, disabled accounts excluded. Cloud/Graph adds fail (HTTP 400) -- all membership writes on CS-SERVER via RMM.
- **`PSO-Caregivers` (Fine-Grained Password Policy, created 2026-07-02):** Precedence 10, `MaxPasswordAge=00:00:00` (never expires). `AppliesTo = SG-Caregivers` -- auto-covers future hires; removal reverts cohort to 42-day domain default. Undo: `Remove-ADFineGrainedPasswordPolicy PSO-Caregivers`.

### Caregiver name changes -- rename, never re-create
**Case:** `b.sika` (Bariffa Sika) -> `c.menle` (Charity Menle, legal name change, 2026-07-09). Procedure: `Set-ADUser` (Surname/DisplayName/UPN/EmailAddress) -> `Rename-ADObject` (CN) -> `Set-ADUser -SamAccountName` -> `Start-ADSyncSyncCycle -PolicyType Delta`. Set `proxyAddresses` explicitly (primary SMTP new + alias old). Password and group membership do NOT change. Vault gotcha: Charity Menle's temp password is still filed under key `b.sika` in the 6/30 vault.

### Caregiver shared phones -- Intune (verified 2026-07-09)
- 25 Samsung shared caregiver phones (`SM-A146U` x16, `SM-S146VL` x9, `SM-A146U1` x1). 14 powered off as of 2026-07-09 (noncompliant status is not a fault). Two duplicate Intune objects (`CSC-R92W60LRA8Z`, `CSC-R9TW20DGYKF`) from re-enrollment.
- **Graph storage fields (`freeStorageSpaceInBytes`, `totalStorageSpaceInBytes`) are NOT collected** for Android Enterprise dedicated devices -- all 26 phones report `free=0`, which means "not reported," not "out of space." **`detectedApps` is empty on every phone** -- not an app-inventory source here.
- `samsungSM-F731U` (John Trozzi's Galaxy Z Flip 5, `trustType: Workplace`) is BYOD -- NOT a shared phone, correctly outside the profile/group.
- **Unresolved:** `CSC-R9TX70L693H` enrolled 2026-07-09, cycled MHS install/uninstall 6 times, stopped checking in. Root cause not established; handset swapped as bad. Stale Intune/Entra records should be deleted. Also stale: `com.microsoft.launcher` (consumer launcher) sits unassigned in the tenant app list -- harmless unless assigned.
- **Caregiver desktop/laptop management:** Hybrid Entra Join + on-prem GPO (Intune Windows MDM `INTUNE_A=PendingInput` -- MS case open, does NOT block caregiver access). `CSC - Caregiver Workstation` GPO (`{3B5CD9A6-A278-4676-A9FD-9396D21A8261}`) built + validated on NURSESTATION pilot.test. `CSC - Caregiver Device Lockdown` GPO (`{E6174988-2721-4D96-ADF5-F5BB44E92769}`) deployed to `OU=Caregiver Devices` 2026-06-05. NURSESTATION still needs reboot to activate lockdown GPO.

### Status (as of 2026-07-15)
- **[ROSTER 2026-07-02]** 7 already-disabled leavers hard-deleted from AD (b.mendoza, c.tate, g.williford, k.flores, d.fierros, m.baker, m.kariuki). `SG-Caregivers` stays 35.
- **[PENDING] Juan Andrade (`j.andrade`) offboard 2026-07-16 afternoon** -- still active and in `SG-Caregivers`. On 7/16 PM: disable + remove from `SG-Caregivers` + reclaim Business Premium. Coord todo `80716a98`.
- **[PENDING]** Zeke Huerta (moved to front desk 2026-07-01, removed from `SG-Caregivers`): no registered MFA method -- Authenticator registration pending. OU move to `OU=Administrative` deferred until that OU enters Entra Connect sync scope.
- **[PENDING] Pilot cleanup:** delete `pilot.test@cascadestucson.com`, clean up `howard.enos@cascadestucson.com`, remove `SG-Caregivers-Pilot` from CA policy targets + delete the group.

---

## Profile

- **Contract type:** Prepaid hour block
- **Billing rate:** $175/hr all labor
- **Hours remaining:** **21.5 hrs as of 2026-07-15 (live Syncro)**. Always live-check via `GET /customers/20149445` before billing.
- **Syncro customer ID:** 20149445
- **Managed devices (Syncro assets):** 29 (live 2026-07-15)
- **Key contacts (Syncro authoritative):**
  - Ashley Jensen -- Administrator (ashley.jensen@cascadestucson.com)
  - John Trozzi -- Maintenance (John.trozzi@cascadestucson.com, 520-365-8200); facility liaison for Helpany
  - Meredith Kuhn -- Assistant Manager (meredith.kuhn@cascadestucson.com, 520-886-3171). **NEVER set as ticket contact in Syncro** -- recurring wrong default.
  - Chef JD Martin (jd.martin@cascadestucson.com, 520-822-4269)
  - Jeff Bristol (accounting@cascadestucson.com)
  - Crystal Rodriguez (crystal.rodriguez@cascadestucson.com)
  - Dalila Sarabia (accountingassistant@cascadestucson.com)
  - Tamra (971-777-9200) -- offboarded 2026-06-30
  - Bill Pay service (account-services@inform.bill.com)
  - Shelby Trozzi -- MemCare Director (MDIRECTOR-PC). Domain account `CASCADES\Shelby.Trozzi` (`OU=Care-Memorycare`, not Entra-synced). First password set + vaulted 2026-07-02. Has `\\CS-SERVER\Company Web Docs` mapped as `W:`, plus FullAccess+AutoMap on Alma Montt's converted shared mailbox.
  - Chris Knight -- Accounting / Business Office (chris.knight@cascadestucson.com). Workstation: DESKTOP-N5G1ROO. Accounting mailbox FullAccess+SendAs granted 2026-07-09.
  - Lauren Hasselman -- Accounting. Lupe Sanchez -- staff (DESKTOP-TRCIEJA, EOL, pending replacement). Karen Rossini, Sharon Edwards, Crystal Rodriguez -- staff.
- **Active tickets:** **0 open Syncro tickets as of 2026-07-15.** See session logs for active project work.

---

## Infrastructure

### Servers & Services

| Host | IP | Role | OS | Notes |
|---|---|---|---|---|
| CS-SERVER | 192.168.2.254 (Hyper-V vEthernet); SMB at **192.168.2.248** | DC, DNS, DHCP (no scopes), File Server, Hyper-V host, Print Server | Windows Server 2019 Standard | Dell PowerEdge R610 (~2009, 16+ years old). **Single DC -- CRITICAL risk.** GuruRMM agent: `c39f1de7-d5b6-45ae-b132-e06977ab1713` (re-enrolls -- resolve live by hostname). **RAID HEALTHY** (live OMSA 2026-06-24). **Datto EDR + Datto AV ACTIVE** (agent `b41befcf-e418-4d0d-8552-bc7662364d07`, heartbeat current, defs current; verified live 2026-07-15). Legacy Datto stack fully removed 2026-06-26; ACG-managed Datto EDR reinstalled 2026-07-13. |
| CS-SERVER iDRAC | 192.168.2.65 | Out-of-band management | -- | Dell OOB. Service Tag **9MQFTK1**. |
| CS-QB (Hyper-V VM) | 192.168.2.228 | SMB/445 only -- NOT a live SIP PBX (2026-06-16 recon). Label "VoIP server" is stale. | -- | Revisit/retire. |
| cascadesDS (Synology NAS) | 192.168.0.120 | NAS / onsite backup (planned repurpose, 60-90 days) | DSM 7.2.1-69057 | DS718+, ext4, 6 GB RAM, 2x WD10EZEX 1 TB. Port 5000 HTTP, Drive Server 6690 SSL. Workgroup "CASCADES" causes Kerberos auth failures from domain-joined machines. **Synology shared-folder syncs to CS-SERVER are SET UP AND WORKING** (Howard confirmed 2026-07-15). Drive Client (v7.5.0.16085) syncs shared folders to `D:\Shares\Main` on CS-SERVER. Planned: repurpose NAS as onsite backup for the server once migration completes (active plan item, 60-90 days). |
| pfSense Firewall | 192.168.0.1 | Perimeter firewall, inter-VLAN routing, DHCP/DNS | pfSense Plus 25.07-RELEASE | Netgate device. cert CN=pfSense-685f277aa6886. Dual-WAN. All DHCP (CS-SERVER DHCP role has no scopes). SSH/22 blocked from OpenVPN subnet -- use GUI (443) remotely. Admin vault: `clients/cascades-tucson/pfsense-firewall`. OpenVPN: `clients/cascades-tucson/pfsense-openvpn-howard`. Config vaulted point-in-time 2026-06-17: `clients/cascades-tucson/pfsense-config-backup-2026-06-17.sops.yaml`. Netgate AutoConfigBackup NOT yet enabled. Logs PLAIN TEXT on 25.07. |

**CS-SERVER RAID detail (live OMSA 2026-06-24, healthy):**

| ID | Size/Type | Make/Serial | Role |
|---|---|---|---|
| 0:0:0 | 1.2 TB SAS | Seagate / Z400WHK8 | VD0 (D:) mirror member |
| 0:0:1 | 1.2 TB SAS | Seagate / S400RL2N | VD0 (D:) mirror member |
| 0:0:2 | 320 GB SATA | Hitachi / 1DR | VD2 (C:) mirror member |
| 0:0:3 | 320 GB SATA | WDC WD3200BEVT / WXEX08URD116 | VD2 (C:) mirror member (was flaky 6/15, self-recovered) |
| 1:0:4 | 1.2 TB SAS | Seagate / Z400WHML | **GLOBAL HOT SPARE** -- do NOT remove |

- VD0 = D: (1,117 GB RAID-1) Ok; VD2 = C: (297.5 GB RAID-1) Ok.
- **[WARN] PSU redundancy lost** (ESM log "Power supply redundancy is lost") -- one PSU not delivering; check cords/feeds/LEDs onsite. Note per Howard 2026-07-15: likely just not connected, not an active work item.
- **Planned reliability upgrade:** replace the two consumer 320 GB drives (0:0:2, 0:0:3) with 2x enterprise SATA SSD already purchased, on a scheduled window with confirmed backup. Service Tag 9MQFTK1.

**Backup:**
- **MSP360/CloudBerry cloud backup on CS-SERVER** -- file-level backup plan last success 2026-07-15 07:00 (daily, verified live). Image-based plan last success 2026-07-05. Installed 2026-06-15 (closes HIPAA SS164.308(a)(7) gap). Retention confirm still pending.
- **Planned:** Synology NAS repurposed as onsite backup target for CS-SERVER (60-90 days, per tech plan).
- **Netgate AutoConfigBackup NOT yet enabled** (pfSense config vaulted 2026-06-17 as point-in-time only).

**Endpoint security:**
- **Datto EDR/AV (Infocyte/azcomp4587) is the ACG-managed endpoint stack.** Org `2d5ea96e-3228-461b-9c60-13ae464b61d8`, target group `1dbd2b02-f7df-45d0-a7f2-18667f48447f`, reg key `6qw68y2rwl`. 35 agents enrolled, all AV-enabled, 28 online (2026-07-15). Install: `Install-EDR -URL "https://azcomp4587.infocyte.com" -RegKey 6qw68y2rwl`.
- **CS-SERVER:** Datto EDR/AV active (agent `b41befcf`, heartbeat current, defs current). Legacy Datto stack removed 2026-06-26; ACG-managed EDR reinstalled 2026-07-13 (RMM cmd `0a60cac7`).
- **Long-stale agents:** desktop-kqsl232 (47d offline -- decommissioned), maintenance-pc (26d offline).
- **Bitdefender decommission substantially complete.** DESKTOP-TRCIEJA still BD_ACTIVE (GravityZone console-only uninstall; retires with planned hardware replacement). DESKTOP-F94M8UT: removed from Datto console (gone as of 2026-07-15 verification). Pending: confirm Cascades removed from Syncro's BD deployment (GUI-only); GravityZone portal cleanup of stale RECEPTIONIST-PC records (company `66b0448e`); reconcile laptop3 (EDR agent, no RMM agent); confirm/remove stale EDR agents laptop1 + cascades-laptop.

### Email & Identity

- **M365 tenant:** cascadestucson.com | Tenant ID: `207fa277-e9d8-4eb7-ada1-1064d2221498`
- **M365 licenses (live Graph 2026-07-15):**
  - Business Premium (SPB): 45 owned / **41 assigned** / 4 free
  - Business Standard: **SUSPENDED** -- ~30 office staff still on it; 29 consumed (jodi.ramstack removed 2026-07-15). Relicensing these users onto supported licenses is a 30-day to-do (~$375-575/mo net-new spend, not savings -- 26 net-new seats; best case ~$374/mo after converting shared mailboxes). Not everyone needs full Office.
- **On-prem AD domain:** cascades.local | UPN suffix: cascadestucson.com
- **MX / mail flow:** Exchange Online (EOP direct MX). SPF: `-all`. DKIM: both M365 selectors published. DMARC: `p=quarantine; pct=100` (live, verified 2026-07-15). Reports to `info@cascadestucson.com` (unmonitored). No third-party email gateway.
- **MFA:** CA policy "Require MFA for all users" enabled. Caregivers excluded from MFA (protected by on-network block + 8h reauth). Voice-call MFA disabled tenant-wide; exception: `SG-MFA-Voice-Call-Scoped-sysadmin` (`304f941e`, single member `sysadmin@`).
- **Entra Connect:** Installed on CS-SERVER 2026-04-25; exited staging 2026-05-14; actively syncing. Sync scope: ONLY `OU=Caregivers`, `OU=Groups`, `OU=Caregiver Devices`. `OU=Administrative` not yet in scope (UPN suffix updates for that OU pending). **Cloud/Graph group adds to `SG-Caregivers` fail (HTTP 400) -- all membership writes on CS-SERVER via RMM.**
- **Break-glass accounts:** `breakglass1-csc@cascadestucson.com`, `breakglass2-csc@cascadestucson.com`. **Not yet created as of 2026-07-15.** Must exist before the final CA allow-list flip.
- **Admin accounts:**
  - `admin@cascadestucson.com` -- Mike's working admin (cloud-only, Connect-excluded)
  - `sysadmin@cascadestucson.com` -- Howard's working admin (cloud-only, Connect-excluded). Object id: `471b13dc-3cf8-416b-a132-f5f3bc8d1cc8`. Vault: `clients/cascades-tucson/m365-sysadmin.sops.yaml`.
- **ALIS (clinical SaaS):** https://cascadestucson.alisonline.com. communityId 622. Vault: `clients/cascades-tucson/alis-sso-app-registration.sops.yaml`; API user: `clients/cascades-tucson/alis-api-howard-user.sops.yaml` (username must be `howard.enos@cascadestucson`). ALIS app id `d5108493-cba8-4f08-90b6-1bb0bc09eb2a`, client secret expires **2028-05-06** (rotation reminder -- expiry breaks ALIS SSO tenant-wide). Staff endpoints are read-only via API -- writes via `alis` skill `build-import` -> upload .xls in ALIS UI.
- **jodi.ramstack DECOMMISSIONED 2026-07-15:** account disabled, sessions revoked, Business Standard license removed (user id `b7cddbeb-6026-436b-a3aa-67c4be43e3fb`). No mailbox existed (deprovisioned by the suspended subscription; last sign-in 2025-03-28). Account object retained disabled/unlicensed.
- **Audit retention:** Approved 2026-04-29. Azure Log Analytics (90d) + Storage Account (6yr) in ACG subscription `e507e953-2ce9-4887-ba96-9b654f7d3267`, RG `rg-audit-cascadestucson`. **Not yet built.**
- **[SECURITY -- OPEN]** `ComputerGuru - Tenant Admin` SP holds a standing **Privileged Authentication Administrator** role (stranded from Alma Montt offboarding; Graph blocked teardown). Needs a Global Admin to remove in Entra (Roles & admins -> PAA -> remove SP). Leave its Conditional Access Administrator role. Pending Mike's decision.
- **Shared mailboxes (live state):**
  - `grievances@cascadestucson.com`, `Surveys@cascadestucson.com` -- created 2026-06-12; Meredith Kuhn + Ashley Jensen, FullAccess+SendAs.
  - `accounting@cascadestucson.com` ("Accounting Dept.") -- delegates: Lauren Hasselman, Ashley Jensen, Zachary Nelson, Chris Knight (added 2026-07-09), each FullAccess (auto-mapping) + SendAs.
  - Alma Montt's mailbox -> SharedMailbox (Shelby Trozzi FullAccess+AutoMap, 2026-06-25).
  - Tamra Matthews' mailbox -> SharedMailbox (Crystal Rodriguez, Megan Hiatt, Meredith Kuhn, Ashley Jensen FullAccess+AutoMap, 2026-06-30).
- **Inky:** No deployment exists. Confirmed 2026-06-04.
- **HIPAA BAA:** Covered by Microsoft Customer Agreement for Business plan subscribers (confirmed 2026-05-14). Medtelligent (ALIS) BAA not yet verified.

### Network

- **ISP / WAN:** Dual-WAN Cox. WAN1 igc0 `184.191.143.62/30` (Cox Fiber, primary, gw `184.191.143.61`) + WAN2 igc3 `72.211.21.217/27` (Cox Coax, secondary, static). `WAN_Group` gateway group. Measured: WAN1 ~522 Mbps upload; WAN2 coax upload unmeasured.
- **Firewall:** pfSense Plus 25.07-RELEASE at `192.168.0.1`. Admin vault: `clients/cascades-tucson/pfsense-firewall.sops.yaml`. Split-tunnel OpenVPN (Howard): `clients/cascades-tucson/pfsense-openvpn-howard.sops.yaml` (route `192.168.0.0/22`; use OpenVPN GUI or OpenVPN Connect with DCO disabled). **[ROUTING GOTCHA 2026-06-30]** LAN "Default allow LAN to any" rule Gateway=WAN_Group policy-routes LAN->internal-VLAN traffic out the WAN. Fixed with a top LAN pass rule (src CS-SERVER `192.168.2.248`, dst `10.0.20.0/24`, gw=default). pfSense OpenVPN `--inactive` idle timeout ~300s (not yet fixed).
- **LAN / VLAN layout:** Primary staff/AP network `192.168.0.0/22`. **Staff/Internal VLAN 20** ("CSCNET", `10.0.20.0/24`, gw `10.0.20.1`). **Voice VLAN 30** (`10.0.30.0/24`, gw `10.0.30.1`). **Guest VLAN 50** (`10.0.50.0/24`, RFC1918 blocked). **CSC Internal VLAN 10** (mgmt). Per-unit /28 VLANs: ~240 networks (VLANs 101-631 for per-room resident isolation, `10.[floor].[room].0/28`). DHCP backend: ISC (Kea config present, dormant). Unbound DNS.
- **[STATUS 2026-07-01] VLAN 20 migration -- machines essentially done, printers lagging.** 22 online hosts on VLAN 20 (10.0.20.x); only CS-SERVER (by design) + ~6 stragglers remain on 192.168.x. Printer shares: only **4/15** repointed (FrontDesk .221, BusinessOffice .220, LifeEnrichment .94, MCReception .78); the other 11 still point at old-LAN IPs. MCMedTech stale at 192.168.2.53 (target 10.0.20.74 live+reachable). GPO `CSC - Point and Print (CS-SERVER)` pilot-scoped to DESKTOP-H6QHRR7 only. Map: `docs/printer-gpo-map.md`.
- **Switching (live 2026-07-15):** 11 switch objects in UniFi (8 online, 2 offline USL24PB -- "Switch 2nd Floor #2" and "Switch 4th Floor #2" -- **offline by design, not an issue**, Howard confirmed 2026-07-15; 1 USPM16P pending). **~25 switch ports at 100 Mbps but gig-capable** (systematic cabling/NIC issue, 1st/2nd/3rd-floor switches). 34 active 100Mb switch ports + 5 APs uplinked at 100Mb (APs 122, 145, 204, 236, 240 -- highest-impact). Port p38 (1st Floor USW) 4.0% tx-drop rate. Full UniFi managed via UOS controller (172.16.3.29, HTTPS 11443; Cascades site `va6iba3v`, site_id `685f39068e65331c46ef6dd2`).
- **WiFi -- 77 U7-Pro APs (75 online, 2026-07-15).** CSCNet (shared PPSK, ~230-242 per-key->network mappings, wlanconf `685f39078e65331c46ef7ee5`, vault `clients/cascades-tucson/wifi-cscnet.sops.yaml`). CSC ENT (legacy, being repurposed as 5 GHz-only WPA2 PPSK "device island" for Poly voice + Helpany sensors). Guest (isolated, VLAN 50). Mesh topology: 2nd Floor Atrium is wireless-mesh parent for CC Bridge + salon (5 GHz backhaul ch36); 206 U7 Pro carries AP 108.
- **Wireless RF (applied 2026-06-19, validated):** 2.4 GHz -> MEDIUM power on 47 radios (non-regressive; corrected over-thinning regression). 5 GHz -> clean DFS 40 MHz plan on 72 non-mesh APs (ch 52/60/100/108/116/124/132/140, 0 co-channel) -- retry HALVED (8.7->3.8 avg). CSCNet BSS-transition (802.11v) ON. 6 GHz BLOCKED on CSCNet (WPA3 mandate; Howard's supervised decision to enable). DFS channels at this site 4-5x cleaner than non-DFS (survey-proven); never apply a non-DFS-only policy without measuring first.
- **Voice VLAN 30 (COMPLETE 2026-06-19):** HIPAA-isolated VLAN 30 (`10.0.30.0/24`). 37 devices: 28 Poly phones + 8 AudioCodes (`.224-.231`) + Vertical desktop (`10.0.30.201`, MAC `e4:e7:49:52:3a:06`, wired, LogMeIn). Phones mark DSCP EF (46). Voice PPSK vault: `clients/cascades-tucson/wifi-voice-ppsk.sops.yaml`. Bistro phone replaced Kitchen server phone (bad, pulled 2026-06-19) -- Bistro now has no phone (pending replacement). QoS design ready (`docs/network/phase1-voice-qos-design.md`) but NOT built; blocker: WAN2 coax upload figure.
- **VoIP vendor: Vertical (Richard Turner rturner@vertical.com).** Two phone fleets: 8 AudioCodes (wired, externally powered, PoE OFF) + 28 Poly (WiFi via CSCNet PPSK). Vertical manages phones remotely. Dropped-calls root cause is RF band selection (Poly on saturated 2.4 GHz); CSC ENT device-island plan is the fix (dedicate 5 GHz SSID for Poly + Helpany). Poly cannot statically select a band -- a separate 5 GHz SSID is required (confirmed by Richard Turner 2026-06-24).

### External Vendors & Mail Senders

- **Helpany (resident safety sensors):** "Paul" = ceiling-mounted radar fall/motion sensors (Sedimentum backend, no camera/mic). WiFi: **WPA2-only, NOT WPA3/hybrid**; 5 GHz-capable. Currently on CSC ENT (key `Ftfd85710#`), migrating to the 5 GHz device-island. Facility liaison: John Trozzi.
- **bill.com (BILL):** Sends from `inform.bill.com`, `hq.bill.com`, `hello.bill.com`, `mc.bill.com`. Safe sender: `account-services@inform.bill.com`. Confirmed delivering to accounting staff.
- **BOK Financial:** DMARC p=reject; zero historical emails to cascadestucson.com (wrong recipient address on BOK's side).

### Business Applications & Reporting Systems

| System | Function | Notes |
|---|---|---|
| ALIS (Medtelligent) | Clinical EHR | SSO live. HIPAA -- BAA required before PHI leaves. communityId 622. |
| QuickBooks | Accounting | Running on CS-SERVER (should NOT be on a DC). |
| Bill.com | AP/AR | REST API automatable. |
| Relias | Training / LMS | Export / API. |
| You've Got Leads | Senior-living CRM | Export / API varies. |
| TELS (Direct Supply) | Facilities | Export; API uncertain. |
| Focus HR | HR / payroll | Export or vendor API. |
| Helpany (app.safe-living.com) | Caregiver app | Export-only likely. |
| POS | Point of sale | TBD. |

**[PROPOSED] KPI dashboard (Ashley Jensen request, 2026-06-17):** Phase 1 scheduled CSV/Excel exports -> SharePoint -> Power BI Pro; Phase 2 API-capable systems (Bill.com, QuickBooks Online) via Power Automate. Parked pending Ashley's day-one KPIs + data-freshness need + POS/Focus-HR specifics + ALIS analytics availability. Scoping: `clients/cascades-tucson/docs/proposals/kpi-dashboard.md`.

---

## Access

- **CS-SERVER:** Via ScreenConnect or GuruRMM (agent `c39f1de7-d5b6-45ae-b132-e06977ab1713`; re-enrolls -- resolve live by hostname). Vault: `clients/cascades-tucson/cs-server.sops.yaml` (username `sysadmin`).
- **CS-SERVER iDRAC:** 192.168.2.65
- **pfSense admin (HTTPS):** https://192.168.0.1 -- vault: `clients/cascades-tucson/pfsense-firewall.sops.yaml`
- **pfSense SSH:** `ssh admin@192.168.0.1` (system OpenSSH) -- **tcp/22 blocked from OpenVPN subnet; use GUI remotely**
- **pfSense OpenVPN (Howard):** vault: `clients/cascades-tucson/pfsense-openvpn-howard.sops.yaml` (split-tunnel, route `192.168.0.0/22`)
- **pfSense config backup (2026-06-17):** `clients/cascades-tucson/pfsense-config-backup-2026-06-17.sops.yaml`
- **Synology DSM:** http://192.168.0.120:5000 -- vault: `clients/cascades-tucson/synology-cascadesds.sops.yaml`. **[SECURITY]** Cloud Signin Portal credential was committed plaintext at vault commit 1fbc0e1 -- encrypted go-forward but **must be rotated.**
- **M365 admin:** admin@cascadestucson.com -- vault: `clients/cascades-tucson/m365-admin.sops.yaml`
- **M365 sysadmin:** sysadmin@cascadestucson.com -- vault: `clients/cascades-tucson/m365-sysadmin.sops.yaml`
- **WiFi CSCNet:** vault: `clients/cascades-tucson/wifi-cscnet.sops.yaml`
- **WiFi Voice PPSK (VLAN 30):** vault: `clients/cascades-tucson/wifi-voice-ppsk.sops.yaml`
- **Android enrollment token:** vault: `clients/cascades-tucson/intune-android-enrollment-token.sops.yaml`
- **MDM service account:** vault: `clients/cascades-tucson/mdm-service-account.sops.yaml`
- **svc-scan (scan-to-folder):** vault: `clients/cascades-tucson/svc-scan.sops.yaml`
- **ALIS SSO app registration:** vault: `clients/cascades-tucson/alis-sso-app-registration.sops.yaml`; API user: `clients/cascades-tucson/alis-api-howard-user.sops.yaml`
- **Caregiver temp passwords (2026-06-30):** vault: `clients/cascades-tucson/caregiver-temp-passwords-2026-06-30.sops.yaml`. Retrieve with `vault get` (NOT `get-field`). Do NOT inline values.
- **Caregiver temp passwords (2026-07-01, 4 new hires):** vault: `clients/cascades-tucson/caregiver-temp-passwords-2026-07-01.sops.yaml`. Same retrieval rules.
- **Shelby Trozzi (domain account):** vault: `clients/cascades-tucson/shelby-trozzi.sops.yaml`. Not Entra-synced (safe to reset on-prem without M365 impact).
- **UOS controller SSH (root):** vault: `infrastructure/uos-server-ssh-key`
- **UOS controller RW admin (Network API):** vault: `infrastructure/uos-server-network-api-rw`
- **UniFi AP device auth (Cascades):** vault: `clients/cascades-tucson/unifi-ap-ssh`
- **Remediation tool:** Full tiered app suite consented 2026-04-21. All six apps active: Security Investigator (`bfbc12a4`), Exchange Operator (`b43e7342`), User Manager (`64fac46b`), Tenant Admin (`709e6eed`), Defender Add-on, Intune Manager.
- **Vault root:** `clients/cascades-tucson/`

---

## Patterns & Known Issues

### Syncro / Billing

- **Never set a contact on any Syncro ticket unless explicitly requested.** Meredith Kuhn is the recurring wrong default Syncro pre-selects -- she is not the correct contact. Leave `contact_id` blank.
- **Billing product for prepaid block draw:** Use a real labor type (Remote, Onsite, etc.) -- NOT "Prepaid project labor" (exempt, won't decrement the block).
- **Always live-check hours before billing:** `GET /customers/20149445`.
- **Windows Home->Pro upgrade billing:** Syncro product "Windows Pro Upgrade" id 23571919 ($99/machine). MAK: vault `infrastructure/windows-pro-mak.sops.yaml`.

### Exchange Online / Message Tracing

- **Get-MessageTrace is hard-deprecated (Sept 2025).** Use `Get-MessageTraceV2` instead (`ResultSize` not `PageSize`). V2 max window 10 days -- loop 9 consecutive windows for 90-day coverage. Deprecation error may be silently swallowed by downstream jq filters -- check the raw response if trace returns unexpectedly empty.
- **Sender-side suppression (SendGrid ESP):** If a user never receives mail from a specific sender and message trace shows zero records, consider a SendGrid suppression list (fix = contact sender's support, no M365 action). Confirmed with bill.com.
- **AutoMapping rolls back on rapid sequential grants.** Grant one user at a time, spaced ~6-8s; poll until removed before the next grant. (Tamra Matthews offboarding root cause, 2026-06-30.)
- **Get-RecipientPermission replication lag:** an immediate read-back after a SendAs grant can miss the new trustee (EXO replica lag); re-read before concluding the write failed. (Chris Knight accounting mailbox, 2026-07-09.)

### Active Directory / User Management

- **Security group assignment is always explicit.** When creating any Cascades user, ask which security group(s). OU -> group auto-mirror was explicitly declined 2026-05-14.
- **`SG-Caregivers` = frontline caregivers ONLY** (Howard 2026-06-30). Admin-adjacent staff (Feller, Nyanzunda), `pilot.test`, disabled accounts excluded. Cloud/Graph adds fail (HTTP 400); all writes on CS-SERVER via RMM.
- **Entra Connect sync scope is narrow -- do not OU-move a synced caregiver.** Scope covers ONLY `OU=Caregivers`, `OU=Groups`, `OU=Caregiver Devices`. Moving a caregiver to any other OU deletes its cloud object (Zeke Huerta, front desk role change, 2026-07-01 -- OU move deferred).
- **Caretaker roster reconciliation is a standard cycle** (last run 2026-07-01): pull live `OU=Caregivers` + `SG-Caregivers` via RMM, diff 1:1 against the client's list, per-person decisions (disable+remove+reclaim for leavers; create+group+license+temp-password for new hires; resolve name duplicates). License math and CA policy exclusions ride on `SG-Caregivers` membership.
- **New user mandatory order (folder redirection):**
  1. Create AD user
  2. Run `New-HomeFolder -Username "<sam>"` on CS-SERVER
  3. Add to SG-FolderRedirect
  4. THEN first domain logon
  - Skipping step 2 causes fdeploy to cache a failure silently and never retry.
- **Folder redirect recovery:** `clients/cascades-tucson/scripts/fix-shell-redirect.ps1` via GuruRMM while user is logged in. Must set both GUID-based and legacy-name registry keys.
- **fdeploy1.ini flags:** `Flags=187` (changed from 1211 which caused WRITE_DAC failures on new subfolders).
- **[ROOT CAUSE 2026-06-08] Native Folder Redirection was DOA fleet-wide** -- GPO targets were in `fdeploy1.ini` but the Windows FR CSE only reads `fdeploy.ini`. Fixed by writing correct `fdeploy.ini` + version bump. Native FR now works on first logon.
- **`LE` GPO (`{889BE7BE-...}`) has empty `\User` tree** -- Sharon Edwards / Susan Hicks working via registry workaround only. Follow-up: retire the LE GPO and put LE users into `SG-FolderRedirect`.
- **Login-screen hide (`SpecialAccounts\UserList`):** An enabled local admin not visible in the sign-in picker has a `SpecialAccounts\UserList` suppression (DWORD `<username>=0`). Fix: delete the DWORD.
- **Caregiver name change procedure (Charity Menle, 2026-07-09):** `Set-ADUser` -> `Rename-ADObject` -> `Set-ADUser -SamAccountName` -> delta `Start-ADSyncSyncCycle`. Set `proxyAddresses` explicitly. Password and group/license unchanged. Vault: temp password stays under the OLD sAMAccountName key.

### File Shares & Scan-to-Folder (Accounting)

- **Accounting folder:** `D:\Shares\Accounting` on CS-SERVER, shared as `\\CS-SERVER\AcctDept`. **Share is named `AcctDept`, NOT `Accounting`** (a printer share named `Accounting` already exists; do not collide). Users: lauren.hasselman, chris.knight, zachary.nelson (Modify). `svc-scan` for scanner auth (Change). **REUSE `svc-scan` for every future scanner->network-folder setup at Cascades** -- do NOT create a per-printer/per-folder scan account. Vault: `clients/cascades-tucson/svc-scan.sops.yaml`.
- **Brother MFC-L8900CDW "Business Office" (10.0.20.220):** Scan-to-Network profile: path `\\192.168.2.254\AcctDept\Scans`, **Auth Method NTLMv2** (not Auto/Kerberos -- printer can't KDC across VLAN), username `cascades\svc-scan`.
- **Drive maps:** Chris Knight (DESKTOP-N5G1ROO) Y:; Zachary (ACCT2-PC) Y:; Lauren (DESKTOP-H6QHRR7) X: -- all to `\\CS-SERVER\AcctDept`.
- **`\\CS-SERVER\Company Web Docs` (built 2026-07-02):** `D:\Shares\Public\Company Web Docs`, gated at share ACL (Shelby.Trozzi = Change; Admins = Full; NTFS left inherited from `Public`). RMM cannot push the drive map directly (`user_session` double-hop -> SMB error 67); workaround: `cmdkey` + persistent `HKCU:\Network\W` map (mounts at next logon). Reusable pattern: memory `reference_rmm_map_network_drive`.
- **`\\CS-SERVER\Executive` (built 2026-06-24):** `D:\Shares\Executive`, inheritance broken; Ashley.Jensen + Meredith.Kuhn = Modify. Persistent E: on DESKTOP-U2DHAP0 (Ashley) + ASSISTMAN-PC (Meredith). Note: CS-SERVER SMB clients reach it at **192.168.2.248** (registered DNS), NOT .254 (Hyper-V vEthernet).
- **RMM dispatch gotcha:** build UNC from `[char]92` in PowerShell payloads -- literal `\\` collapses to `\` through jq/agent.
- **`\\CS-SERVER\BusinessOffice` = the Accounting Assistant printer (Canon MF455DW, `10.0.20.220`) in room 101.** One physical L8900CDW, one share. Do NOT create a duplicate "Accounting Assistant Printer" queue.

### Printers / VLAN 20 Migration

- **Server-share model is preferred** for domain-joined machines (`\\CS-SERVER\<share>`). Workgroup machines get direct-IP local printer installed as SYSTEM (switch to server share on domain join).
- **Point-and-Print policy prerequisite** for standard users pulling a driver from CS-SERVER: `HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Printers`: `RestrictDriverInstallationToAdministrators=0` + subkey `PointAndPrint` (`Restricted=1, TrustedServers=1, ServerList=CS-SERVER, NoWarningNoElevationOnInstall=1, UpdatePromptSettings=2`). Symptom without it: elevation prompt `0x800702e4` / PrintService event 513 / `0xBCB`.
- **Canon MF741CDW / MF743CDW are UFR II ONLY -- NOT PCL.** A PCL6 driver produces **Error #822**. Pull `Canon Generic Plus UFR II V250` (INF `cnlb0ma64.inf`) from a client DriverStore.
- **Static VLAN 20 printer IPs:** Front Desk Epson ET-5800 = `10.0.20.221` (`\\CS-SERVER\FrontDesk`); Life Enrichment Canon MF741CDW = `10.0.20.94` (`\\CS-SERVER\LifeEnrichment`, UFR II); Business Office Brother L8900CDW = `10.0.20.220`; Dining Room Canon MF743CDW = `10.0.20.228` (DESKTOP-MD6UQI3, direct-IP UFR II); Chef Office Brother MFC-9330CDW = `10.0.20.236` (CHEF-PC, direct-IP); MedTech Brother MFC-L8900CDW = `10.0.20.74`; MC Reception Epson ET-5800 = `10.0.20.78`. Running map: `docs/printer-gpo-map.md`.

### Synology NAS (cascadesDS) / Shared File Access

- **Device (confirmed live 2026-06-25):** DS718+, DSM 7.2.1-69057 Update 11, 6 GB RAM, serial 1920PEN537202. Filesystem ext4; 2x WD10EZEX 1 TB. 10 shares + hidden folders. 30 packages incl. Active Backup for Business 3.1.0, Synology Drive Server 3.5.0.
- **Synology Drive sync to CS-SERVER is ACTIVE AND WORKING** (Howard confirmed 2026-07-15). The earlier "Team Folder migration [PENDING]" notes were stale. Drive Client (v7.5.0.16085, runs as `sysadmin`) syncs shared folders to `D:\Shares\Main` on CS-SERVER. Note: `synopkg status SynologyDrive` falsely returns "stopped" (status 263) even when active -- verify via `systemctl is-active pkgctl-SynologyDrive` and `netstat -tlnp | grep 6690`.
- **Stale Word owner (lock) files on cascadesDS:** Word creates hidden `~$<filename>` files on abrupt session end. Fix: delete the `~$` file(s). (Meredith Kuhn locked doc, 2026-06-10.)
- **Accessing cascadesDS from RMM -- always use a user session, not CS-SERVER SYSTEM.** Domain-joined machine account fails Kerberos against the Synology (workgroup "CASCADES" same short name as AD domain). Run in `user_session` context of a machine where the target user is logged in.

### CS-SERVER SMB & Endpoint AV

- **RMM-dispatched SMB client commands false-negative.** `net use`/`net view`/`Test-Path`/`Get-SmbConnection` in `user_session` return error 67 (BAD_NETWORK_NAME) / RPC 1702 / "none" even for known-good targets. **CS-SERVER SMB is healthy.** Validate server-side via `Get-SmbSession`/`Get-SmbOpenFile` or an interactive test -- never from RMM client-side results. A drive-map `verify` failure is NOT proof of a problem.
- **CS-SERVER endpoint AV history (for context):** Prior-MSP installed Datto EDR "Endpoint Protection SDK" (Bitdefender engine) managed by old Datto RMM/CentraStage -- NOT GravityZone. That stack was fully removed 2026-06-26 (the "Datto removed from CS-SERVER 2026-06-26" note referred to the legacy prior-MSP stack). **ACG-managed Datto EDR (Infocyte HUNT agent `b41befcf`) was installed 2026-07-13 and is active today (verified live 2026-07-15).** The DC was unprotected between 2026-06-26 and 2026-07-13.

### Datto EDR / Bitdefender Decommission

- **Datto EDR/AV (Infocyte/azcomp4587) is the ACG-managed endpoint stack** (org `2d5ea96e`, target group `1dbd2b02`, reg key `6qw68y2rwl`). Install: `Install-EDR -URL "https://azcomp4587.infocyte.com" -RegKey 6qw68y2rwl`.
- **Bitdefender GravityZone BEST removal is CONSOLE-ONLY.** GravityZone Public API `createUninstallTask` is DEAD; BEST anti-tampering blocks endpoint-side uninstall. Use the console "Uninstall client" task (Network -> Cascades company `66b0448e`). New/replacement machines: provision Datto EDR/AV only, never Bitdefender, never carry over prior-MSP Datto RMM/CentraStage artifacts.
- **RECEPTIONIST-PC is two physical boxes sharing a hostname** (frontdesk MJ0KQHNP, MemCare MJ0KQH4R -> staged rename to MEMCARE-STATION, not yet applied -- needs reboot). Reconcile fleets by SERIAL, not hostname.
- **BD detection script:** services `^EP(Security|Protected|Update|Redline|Integration)Service$` + uninstall-registry DisplayName ~ `Bitdefender|GravityZone` + `Test-Path 'C:\Program Files\Bitdefender'`.

### Browser / Edge

- **[BUG - FLEET] Edge 149 cannot open Office files via download-list when Downloads is a UNC-redirected folder** (Chromium issue 519243472). Prepends `\\?\` to UNC paths without converting to `\\?\UNC\`. Affected build: Edge stable 149.0.4022.52. Fix options: (1) update Edge past the fix; (2) interim: `--disable-features=LaunchShellExecuteViaExplorer`; (3) zero-config: use "Show in folder" then double-click; (4) rollback to 148.

### Conditional Access / Caregiver Policies

- **Phased rollout -- never tenant-wide.** CA policies for caregivers target `SG-Caregivers` (`8b8d9222-5d71-419a-936d-56d895c6c332`). **`SG-Caregivers` is 35 members as of 2026-07-01** (after 8 offboarded, 4 new hires, roster reconciled).
- **Enforced caregiver CA policy set:**
  - `CSC - Block caregivers off Cascades network` (`e35614e1`) -- BLOCK if location not Cascades
  - `CSC - Block caregivers on non-compliant device` (`ede985e2`) -- **DISABLED 2026-07-01**. Do not re-enable; superseded by the allow-list at final lockdown.
  - `CSC - Caregiver sign-in frequency 8h` (`7d491c7a`)
- **Caregiver device allow-list (report-only):** `1b7fd025`; state `enabledForReportingButNotEnforced`. Device filter (mode `exclude`): `(device.displayName -startsWith "CSC-") -or (device.extensionAttribute1 -eq "CSCCaregiverDevice")`. Includes: NURSESTATION-PC (deviceId `d3bf931f`), Laptop2, LAPTOP-DRQ5L558, LAPTOP-E0STJJE8, LAPTOP-8P7HDSEI, ASSISTNURSE-PC (needs re-join + re-tag after Win11 reinstall).
- **GDAP exclusion:** CA blocking policies must exclude "Service provider users" (GDAP foreign principals) + `SG-External-Signin-Allowed` + `SG-Break-Glass`.
- **[ROOT CAUSE 2026-07-01] `pilot.test` login success masked two separate blockers.** `pilot.test` is in `SG-Caregivers-DeviceTest` / `SG-Caregivers-Test` -- excluded from the compliance-block and targeted by the allow-list. Live `SG-Caregivers` members hit BOTH problems. A pilot passing on a device-test group does NOT prove the production group will pass the same CA gauntlet.
- **Interim caretaker CA posture (2026-07-01):** desktops AND phones allowed, on-network only. Phones-only lockdown deferred to end of rollout.

### Wireless / UniFi RF

- **[APPLIED 2026-06-19 -- validated] Production RF optimization:**
  - 2.4 GHz power -> MEDIUM on 47 radios; 24 thinned-disabled radios stayed disabled.
  - 5 GHz -> clean DFS 40 MHz channels on 72 non-mesh APs; retry HALVED (8.7->3.8 avg, median 8.2->2.1); 0 radar events.
  - CSCNet BSS-transition (802.11v) ON.
- **Primary pain band is 2.4 GHz.** Avg TX-retry ~10%; cu_total 69-94% live; catastrophic external neighbor BSSID density (ch6 ~33k BSSIDs). IoT/legacy clients stuck on 2.4.
- **6 GHz nearly unused** -- CSCNet not broadcasting 6 GHz (`wlan_bands=[2g,5g]`). 75 radios active but only ~1 client. Enabling requires WPA3+PMF conversion on the 427-client SSID -- Howard's supervised decision.
- **DFS channels here are 4-5x cleaner than non-DFS** (survey-proven; ch149=12%, ch157=28% vs DFS 2-3% busy). Always: scan -> `survey-report.py` -> `channel-plan --channels` -> apply -> validate. Do NOT use UniFi auto-channel or a non-DFS-only policy without measuring.
- **Offline switches (Switch 4th Floor #2, USW Pro Max 16) are offline BY DESIGN -- not an issue** (Howard confirmed 2026-07-15). Do not flag or investigate.
- **AP-hang recovery:** `device-control.sh cascades poe-cycle "<AP name>" --apply`. Do NOT use `force-provision` (took AP 445 offline during the Floor-4 pilot).
- **Tooling (`unifi-wifi` skill):** `audit-site.sh`, `live-stats.sh`, `survey-report.py` (the channel-decision driver), `channel-plan.sh` (data-driven: `--channels <list>` or `--dfs ok|avoid|only`), `apply-radio.sh`, `apply-wlan.sh`, `dfs-check.sh`, `switch-audit.sh`, `device-control.sh`, `pfsense-ssh.sh` (onsite only -- blocked over VPN).

### VoIP / Network Device Migration

- **Re-VLANing a wired switch port requires a link bounce to force re-DHCP.** Changing native VLAN does not reset the NIC link. Bounce via PoE power-cycle (PoE devices) or disable/enable via controller API (non-PoE). A UniFi block/unblock is a MAC filter only -- does NOT bounce the link.
- **Externally-powered devices (AudioCodes desk phones) need a PHYSICAL power-cycle.** 8 AudioCodes are on USW-16-PoE ports 1-8 with external power bricks (PoE OFF on those ports) -- controller PoE-cycle and port disable/enable are both no-ops.
- **UniFi controller PUT 403 / CSRF:** rapid writes can 403 -- read CSRF token from `x-updated-csrf-token` response header.
- **Verify VLAN membership via the client `vlan` field, not the controller's displayed IP.** IP field caches/lags.
- **Build UNC from `[char]92` in RMM PowerShell payloads.** Literal `\\` collapses to `\` through jq/agent.

### Voice QoS (VLAN 30) -- design, NOT yet built

Design: `docs/network/phase1-voice-qos-design.md`. pfSense HFSC shaper on BOTH WANs -- 3 queues `qVoice` (prio 7, realtime ~30%, src `10.0.30.0/24`), `qACK` (~10%), `qDefault` (~60%). UniFi WMM maps DSCP EF -> WiFi Voice AC. Blocker for sizing: WAN2 coax upload number. QoS is insurance (WAN2 failover + rare WAN1 saturation); everyday dropped-calls cause is RF (band selection).

### pfSense Operations

- **pfSense 25.07 logs are PLAIN TEXT.** Read with `tail`/`grep`. `clog` returns empty output.
- **LAN "allow LAN to any" rule policy-routes internal-VLAN traffic out the WAN** (Gateway=WAN_Group). Fix: top LAN pass rule, Gateway=default, scoped source. Do it in the GUI (SSH/22 blocked from OpenVPN subnet).
- **pfSense OpenVPN `--inactive` idle timeout:** ~300s; disconnects idle clients after ~5 min. Keepalive pings do NOT reset it. Fix proposed 2026-06-18; not applied.
- **pfSense dirty-boot / duplicate dhcpd:** After unclean shutdown, dhcpd may start twice. Fix: `killall dhcpd && echo "services_dhcpd_configure();" | /usr/local/sbin/pfSsh.php`; verify one instance: `pgrep -f "dhcpd -user" | wc -l` == 1.

### Known Issues / Pending Hygiene

- **[URGENT -- 2026-07-16 PM] Juan Andrade offboarding.** Disable + remove from `SG-Caregivers` + reclaim Business Premium. Coord todo `80716a98`.
- **[PENDING] Zeke Huerta MFA (Authenticator) registration.** No registered method since front-desk move.
- **[PENDING] Break-glass accounts** (`breakglass1-csc@`, `breakglass2-csc@`) not yet created. Required before final CA allow-list flip.
- **[PENDING] Object-access audit logging on file server** (SS164.312(b) gap). No forensic trail on D:\Homes / PHI shares.
- **[PENDING] BAA inventory incomplete.** Several potential business associates unaccounted for.
- **[PENDING] Stale `SG-Caregivers-Pilot` exclude-group on `Require MFA for all users` policy.** Remove at pilot cleanup.
- **[PENDING] ALIS-native 2FA disable.** Force all ALIS logins through Entra SSO; disable per-user then globally.
- **[PENDING] Microsoft case for `INTUNE_A PendingInput`** -- does NOT block caregiver access (hybrid+GPO path replaces Intune dependency).
- **[PENDING] Named Location tightening.** Non-caregiver devices on the building network can currently pass the location check.
- **[SECURITY] Synology Cloud Signin Portal credential exposed in vault git history (commit 1fbc0e1).** Encrypted go-forward but credential must be rotated.
- **[SECURITY -- OPEN] Tenant Admin SP holds standing PAA role.** See Access section. Pending Mike's decision.
- **[PENDING] MEMCARE-STATION rename not applied.** Staged 2026-06-30 on MemCare RECEPTIONIST-PC box (S/N MJ0KQH4R); still reports as `RECEPTIONIST-PC` -- needs reboot.
- **[PENDING] pfSense OpenVPN `--inactive` timeout fix** and **Netgate AutoConfigBackup** enable.
- **[PENDING] DESKTOP-TRCIEJA GravityZone BD uninstall** (console-only). Box slated for hardware replacement.
- **[PENDING] 6 GHz on CSCNet** -- WPA3 conversion required; Howard's supervised decision.
- **[PENDING] Bistro phone replacement** -- Bistro has no phone (Kitchen server phone pulled 2026-06-19; Bistro phone relocated to Kitchen).
- **[PENDING] MemCare min-RSSI (floors 5/6)** -- deferred until Howard adds new APs to floors 5/6.
- **[PENDING] WAN2 (coax) upload measurement** -- needed to size pfSense HFSC voice QoS.
- **[PENDING] Audit retention infra** (LAW 90d + Storage 6yr) approved 2026-04-29, not yet built.
- **[PENDING] M365 relicensing** -- ~30 office staff on suspended Business Standard; right-size onto supported licenses (~$375-575/mo net-new depending on mix).
- **[WARN] ~25 switch ports at 100 Mbps but gig-capable.** 34 active 100Mb ports + 5 APs uplinked at 100Mb (APs 122, 145, 204, 236, 240). Investigate after WiFi optimization stable.

### Security Incidents (historical)

- **Megan Hiatt (2026-04-16):** Active credential-stuffing -- 126 failed sign-ins, bursts from Belfast GB, Hamburg DE. Password reset + SMTP AUTH disable were action items. Mailbox clean. **Re-verify April remediation held** (flagged again during Tamra offboarding 2026-06-30).
- **John Trozzi (2026-04-16, 2026-04-20):** Investigated twice -- both times NO BREACH.
- **Crystal Rodriguez (2026-04-19):** Phishing investigation. Report: `clients/cascades-tucson/reports/2026-04-19-crystal-rodriguez-phish-investigation.md`.
- **Canva email delivery (2026-05-20):** Resolved by adding canva.com domains to AllowedSenderDomains in EOP.
- **ALIS AADSTS65001 (2026-06-03):** Resolved by granting tenant-wide admin consent on ALIS SP (`e1cae4ad`).
- **Chris Knight bill.com / BOK email delivery (2026-06-04):** Root cause sender-side (SendGrid suppression; BOK wrong recipient email). Resolved externally. Ticket #32383.
- **dunedolly21@gmail.com:** External guest invited 2026-04-14 by Lauren Hasselman. Status unknown -- confirm with Lauren. [unverified]

### HIPAA Compliance

- **Primary objective.** CS-SERVER and ALIS store PHI.
- **Critical open gaps:** No audit logging on D:\Homes (SS164.312(b)); Object Access auditing disabled on CS-SERVER; no SMB encryption on homes share; audit retention infra approved but not built; BAA inventory incomplete; break-glass accounts not created.
- **Closed gaps:** Backup (MSP360 cloud backup 2026-06-15); MFA / CA for all users; caregiver access restricted to building network (2026-07-01); auto-lock + auto-sign-out on shared caregiver devices (GPO deployed 2026-06-05); Voice VLAN 30 isolates PHI from phone traffic (2026-06-19); HIPAA BAA covered by MCA (confirmed 2026-05-14); 7 deleted mailboxes restored 2026-04-25 for 7-year retention.
- **Termination policy established:** convert to shared mailbox, hide from GAL, retain 7 years. Litigation Hold available (Exchange Plan 2) but waived for the two 2026-06 offboardings (Alma, Tamra) per Howard's explicit no-PHI/PHI-adjacent-authorized calls.

---

## Active Work

> **Canonical remaining-work plan: `docs/REMAINING-WORK-PLAN.md`** (built 2026-06-24; refreshed 2026-07-13/14). 7 sequenced workstreams. Work from it.

*No open tickets in Syncro as of 2026-07-15. See session logs for recent work.*

- **[URGENT -- 2026-07-16 PM] Juan Andrade offboarding** -- disable + remove from `SG-Caregivers` + reclaim Business Premium. Coord todo `80716a98`.
- **[IN PROGRESS] Caregiver phone SSO -- ALIS email-match (Howard handling), roster now 35.** Remaining: ALIS Email=UPN match for existing caregivers; build ALIS staff records for Munezero, Cota, Robinson; set Vallejo's ALIS Email=a.vallejo@; 7 discharged-record decisions; Kariuki ALIS dup (429856/429858) if she returns.
- **[IN PROGRESS, machines ~done / printers lagging] VLAN 20 (CSCNET) staff + printer migration.** 22 machines on VLAN 20; only CS-SERVER (by design) + ~6 stragglers remain. Printer shares 4/15 repointed. Next: decide reboot-test vs pre-stage-drivers for Point-and-Print GPO, take it fleet-wide; repoint MCMedTech + 4 remaining stale caregiver-GPO shares; reboot MemCare RECEPTIONIST-PC box (MEMCARE-STATION rename pending reboot); domain-join workgroup boxes.
- **[SECURITY] Break-glass accounts** (`breakglass1-csc@`, `breakglass2-csc@`) not created. Required before final CA lockdown.
- **[SECURITY] Remove standing PAA role from Tenant Admin SP.** Needs Global Admin. Pending Mike.
- **[FOLLOW-UP] Megan Hiatt breach re-check** -- `CREDENTIAL_STUFFING_ACTIVE` marker from April; verify remediation held.
- **[IN PROGRESS] CARF Technology and System Plan** -- finalized 2026-07-15 (`clients/cascades-tucson/docs/proposals/cascades-technology-plan-2026-07-15.md` + .html/.pdf, 4-page branded deliverable). Howard delivering to Mike/client. Governance placeholders (*[at adoption]*) to be filled when Cascades formally adopts.
- **[IN PROGRESS] Datto EDR/AV rollout + Bitdefender decommission.** 35 agents enrolled; CS-SERVER covered. Remaining: DESKTOP-TRCIEJA GravityZone console uninstall; confirm Cascades removed from Syncro BD deployment; GravityZone portal cleanup stale RECEPTIONIST-PC records; reconcile laptop3; confirm/remove stale EDR agents laptop1 + cascades-laptop.
- **[URGENT] Order replacement workstation for Lupe Sanchez (DESKTOP-TRCIEJA).** EOL hardware; decision made 2026-06-18.
- **[URGENT] Rotate exposed Synology Cloud Signin Portal credential** (vault commit 1fbc0e1 plaintext exposure).
- **[PENDING] Bistro phone replacement** (no phone in Bistro since 2026-06-19 Kitchen relocation).
- **[PLANNED -- 60-90 days] Repurpose Synology NAS as onsite backup for CS-SERVER** (per tech plan; online off-site backup continues).
- **[PLANNED] CSC ENT device-island consolidation** (Poly voice + Helpany sensors -> 5 GHz-only WPA2 PPSK; enables later CSCNet WPA3/WiFi7/6 GHz). Design: `docs/network/csc-ent-device-island-plan.md`.
- **[PLANNED -- hardware] CS-SERVER SSD upgrade** (2x enterprise SATA SSD already purchased; scheduled window with confirmed backup).
- **[PLANNED] Voice QoS for VLAN 30** -- design done, not built. Blocker: WAN2 coax upload.
- **[PLANNED] Network logging / observability** -- Synology as syslog collector, pfSense + UniFi + AP sources. Spec: `docs/network/network-logging-plan.md`.
- **[PLANNED] KPI dashboard (Ashley Jensen)** -- parked pending Ashley's day-one KPIs.
- **[PENDING] Home->Pro upgrade: CascadesProxess** -- deferred to a late-night window (access-control appliance, active use). 2 x $99 (NurseAssist + DESKTOP-MD6UQI3) not yet invoiced -- Syncro product 23571919.
- **[PENDING] Enable 6 GHz on CSCNet** -- WPA3 conversion, Howard's decision.
- **[PENDING] Enable Netgate AutoConfigBackup** on pfSense.
- **[PENDING] pfSense OpenVPN `--inactive` timeout fix.**
- **[PENDING] ALIS app session timeout** lower from 20 to 15 min (Howard, ALIS admin).
- **[PENDING] File server audit logging** (SS164.312(b) gap -- no NTFS/object-access audit trail on D:\Homes).

**Device-readiness for domain migration (2026-06-24 audit + 6/26 upgrades):**
- **READY to join:** DESKTOP-LPOPV30 (Karen), MAINTENANCE-PC, LAPTOP-E0STJJE8; after reboot: ASSISTMAN-PC, ANN-PC, Laptop2; NurseAssist + DESKTOP-MD6UQI3 now Pro (6/26).
- **BLOCKED -- Windows Home:** LAPTOP-8P7HDSEI, MDIRECTOR-PC, MEMREct-PC. CascadesProxess deferred.
- **EOL/replace:** DESKTOP-TRCIEJA (Lupe Sanchez), ASSISTMAN-PC (Meredith), MDIRECTOR-PC (Shelby), MEMRECEPT-PC (MC front desk), CHEF-PC (Culinary) + spare deploy. Per CARF tech plan.

---

## History Highlights

| Date | Event |
|---|---|
| 2026-03-06 | ACG onboarding begins. Initial audit (CS-SERVER Dell R610, pfSense, UniFi, Synology). 19 machines. No backup, no HIPAA compliance. |
| 2026-03-09 | AD security hardening: Monica Ramirez removed from Domain Admins, lockout policy fixed, AD Recycle Bin enabled, MachineAccountQuota set to 0. |
| 2026-03-31 | Cascades onboarded to remediation tool. Tenant ID documented. 50 users, Secure Score 34%. |
| 2026-04-13 | Major onsite: 13 stale AD accounts deleted, OU structure cleaned, UPNs migrated to cascadestucson.com, Homes share created, Folder Redirection GPO deployed (registry workaround), first domain joins. |
| 2026-04-14 | Sandra Fish global admin revoked. ALIS SSO confirmed. Business Premium proposal created. |
| 2026-04-16 | Breach checks: Megan Hiatt (credential stuffing, not breached; password reset). John Trozzi (clean). Crystal Rodriguez phish. |
| 2026-04-17 | Howard onsite: folder redirect Sharon Edwards diagnosis. John Trozzi WiFi (TP-Link + UniFi roaming instability). |
| 2026-04-25 | Entra Connect installed on CS-SERVER (staging mode). 7 deleted mailboxes restored for HIPAA. Dual-WAN discovered. |
| 2026-04-28-29 | CA policy reconciliation. Audit retention architecture (ACG-billed, LAW 90d + Storage 6yr). Break-glass design (2 accounts, YubiKeys). Caregiver pilot scope corrected (phased only). |
| 2026-04-30 | CA rollout (Report-only mode): 3 caregiver policies created. SDM bootstrap. |
| 2026-05-01 | Howard billed 33.5 hrs against prepaid block on Entra project ticket #32214 ($0 invoice). |
| 2026-05-07-08 | SDM phone provisioning. SDM token success. ALIS SSO app registration values captured to vault. |
| 2026-05-14-16 | Caregiver AD accounts created. Entra Connect exited staging -- actively syncing. Wireless diagnostic (2.4 GHz saturation hypothesis identified). |
| 2026-05-18 | Billing review. 7 hrs billed separately. |
| 2026-05-20 | Canva email delivery resolved (canva.com domains added to EOP). |
| 2026-05-21 | Crystal Rodriguez folder redirect confirmed working. |
| 2026-05-22 | Ashley Jensen domain-joined. RECEPTIONIST-PC domain-joined. GPO ILT fixes. cascadesDS auth failure diagnosed (workgroup collision) and deferred. |
| 2026-05-23 | Lauren Hasselman folder redirect complete. |
| 2026-05-26 | Access control vendor meeting onsite (ticket #32324). 0.5h Howard + 0.5h Mike billed. |
| 2026-06-03 | ALIS AADSTS65001 resolved: tenant-wide admin consent on ALIS SP. Caregiver device allow-list CA policy created (report-only, `1b7fd025`). |
| 2026-06-04 | Three same-day tickets: #32381 Tamra scanner (0.5h onsite), #32382 Megan file access (1.5h onsite), #32383 Chris Knight bill.com/BOK email delivery (1.5h remote, root cause sender-side). |
| 2026-06-05 | NURSESTATION-PC localadmin login-screen issue resolved. Hybrid Entra Join + GPOs deployed: `CSC - Caregiver Workstation` validated; `CSC - Caregiver Device Lockdown` deployed to `OU=Caregiver Devices`. Ticket #32303, 7.0h. |
| 2026-06-08 | Chris Knight workstation setup (onsite). DESKTOP-N5G1ROO domain-joined + GuruRMM-enrolled. Root-caused native Folder Redirection failure -- fdeploy1.ini misnamed; fixed with correct fdeploy.ini + version bump. ASSISTNURSE-PC reinstalled (Win10->Win11). Edge UNC download bug diagnosed. |
| 2026-06-09 | Accounting scan-to-folder built. D:\Shares\Accounting on CS-SERVER; shared as \\CS-SERVER\AcctDept; svc-scan service account vaulted; Brother MFC-L8900CDW Scan-to-Network configured (NTLMv2, confirmed). |
| 2026-06-10 | Meredith Kuhn locked Word doc -- stale owner files on cascadesDS. Five ~$ files deleted. Ticket #32403, 0.5h remote. |
| 2026-06-12 | Created shared mailboxes grievances@ + Surveys@ and delegated to Meredith + Ashley. All 8 permission grants verified. Ticket #32417, 0.5h remote. |
| 2026-06-15 | Wireless RF full audit -- controller access gained. 77 U7-Pro APs, ~574->587 clients, 2.4 GHz saturation confirmed as primary pain. CS-SERVER backup started (MSP360/CloudBerry). pfSense OpenVPN password reset. |
| 2026-06-16 | Voice VLAN plan for Vertical phones designed. Floor-4 2.4 GHz power-down pilot applied. dfs-check.sh confirmed ZERO real radar events fleet-wide. unifi-wifi skill feature-complete. pfSense confirmed pfSense Plus 25.07-RELEASE. |
| 2026-06-17 | Voice VLAN 30 built + verified; Vertical desktop + initial Poly phones migrated. Power outage -- full site down + recovery (pfSense on UPS surge-only side -> unclean shutdown -> duplicate dhcpd + 2nd-floor switch one-way L2; recovered; pfSense moved to battery). Plaintext Synology signin credential found (vault commit 1fbc0e1). KPI dashboard scoping (advisory, parked). |
| 2026-06-18 | Voice VLAN 30 cutover (8 AudioCodes added; 22 Poly done). AudioCodes required physical power-cycle. Per-phone diagnosis: dropped-calls are RF (band selection), not VLAN. 6 GHz root-caused dark. Optimization master plan built. DESKTOP-TRCIEJA (Lupe Sanchez) perf diagnosed; replace decision. Synology Drive sync architecture diagnosed. |
| 2026-06-19 | PRODUCTION RF OPTIMIZATION APPLIED (2 AM window): 2.4 GHz power -> MEDIUM on 47 radios; clean DFS 40 MHz plan applied to 72 non-mesh APs; 5 GHz retry HALVED. Voice VLAN migration COMPLETE (29/29 Poly re-keyed). Kitchen server phone bad (pulled); Bistro phone relocated. Billed ticket #32444, 7h. |
| 2026-06-23 | Planned power outage (05:30-09:00 MST) -- clean shutdown executed. All three core devices self-shut-down on local schedules. Verified clean at 05:31. |
| 2026-06-24 | CS-SERVER RAID live-verified healthy (live OMSA; the earlier "degraded" flag was stale; 6/15 self-recovered; 1:0:4 = GLOBAL HOT SPARE). PSU redundancy lost noted. Executive share built (\\cs-server\Executive, billed 0.5h). Live AD+RMM domain-join diff; built docs/REMAINING-WORK-PLAN.md (7 workstreams). CARF Technology and System Plan deliverable started (Ashley Jensen). CSC ENT device-island consolidation plan (voice + Helpany). |
| 2026-06-25 | Alma Montt OFFBOARDED (terminated; MC Life Enrichment; no PHI/ALIS). Endpoint security migration begins: Datto EDR/AV rollout + Bitdefender decommission started; RECEPTIONIST-PC identified as two physical boxes. |
| 2026-06-26 | CS-SERVER: full legacy Datto stack removal + SMB "outage" debunked (was a test-method artifact -- RMM-dispatched SMB cmds false-negative). EDR/Bitdefender straggler 9am pass. Windows Home->Pro upgrades: NurseAssist + DESKTOP-MD6UQI3 upgraded to Pro for Workstations (2 x $99, to invoice). |
| 2026-06-29 | ALIS caregiver phone-only + caretaker-only crosscheck: phone-only caregivers = NONE (only 3 Transportation drivers are phone-only, no ALIS needed). 7 caregiver-list people exist in ALIS only as Discharged records. |
| 2026-06-30 | Caregiver phone SSO -- license + group + temp-password onboarding complete for 40 frontline caregivers (Business Premium assigned; vaulted temp passwords; `SG-Caregivers` corrected to frontline-only). Tamra Matthews OFFBOARDED (Move-In Coordinator). VLAN 20 printer migration (FrontDesk, LifeEnrichment, others); policy-routing root cause found + fixed in pfSense. MEMCARE-STATION rename staged. |
| 2026-07-01 | VLAN 20 migration live-reconciled -- 22 machines on VLAN 20, printer shares 4/15. Caretaker roster update: 8 accounts disabled + license reclaimed, 4 new hires created (Vallejo, Munezero, Cota, Robinson), Zeke Huerta moved to front desk (OU move deferred). SG-Caregivers now 35. CA phone/desktop login verified end-to-end; two CA blockers fixed (pilot.test had masked both). Interim caretaker CA posture (desktops + phones, on-network only) -- Howard's go, overrides 6/24 hold. |
| 2026-07-02 | Caregiver phone login: forced-change gotcha resolved (cleared `ChangePasswordAtLogon` for all 35 SG-Caregivers -- had failed as err=50126). PSO-Caregivers (never-expire FGPP) created on CS-SERVER. Shelby Trozzi "Company Web Docs" share built; domain account password vaulted. |
| 2026-07-09 | Charity Menle caregiver rename (AD rename procedure established, never re-create). Chris Knight granted FullAccess+SendAs on accounting@ SharedMailbox. Android enrollment token replaced (Replace, not Revoke -- stale token root-caused). Intune: 14 phones powered off (noncompliant status not a fault); storage fields confirmed not collected for COSU devices. |
| 2026-07-13 | Datto EDR installed on CS-SERVER (closing DC coverage gap since 2026-06-26 legacy-Datto removal). HUNTAgent=Running, RMM cmd 0a60cac7. Wiki + REMAINING-WORK-PLAN.md refreshed. Juan Andrade offboard moved to 2026-07-16 afternoon; coord todo 80716a98 created. |
| 2026-07-14 | Wiki + remaining-work-plan reviewed end-to-end (recovered session). HIPAA gaps identified: Juan Andrade access overdue, no break-glass accounts, Named Location too loose, no object-access audit logging, BAA inventory incomplete. |
| 2026-07-15 | CARF Technology and System Plan finalized (4-page branded PDF, Done/To-do per area, 8 CARF areas + supplementary). Live verification sweep confirmed: EDR/AV active on all 35 agents incl. CS-SERVER; M365 SPB 45/41/4; DMARC/DKIM/SPF live; VLAN 30 voice 37 clients; MSP360 file backup success today. jodi.ramstack DECOMMISSIONED (disabled, sessions revoked, Business Standard license removed; no mailbox existed). Synology shared-folder syncs to CS-SERVER confirmed working (stale wiki notes corrected). Mike (GURU-5070) verified EDR and M365 licensing live; sent correction to Howard via coord. |

---

## Backlinks

- [[projects/gururmm]] -- RECEPTIONIST-PC + CS-SERVER enrolled (site CascadesTucson); fleet EDR/BD + Home->Pro + printer work driven via GuruRMM
- [[wiki/systems/uos-server]] -- UniFi controller hosts Cascades site va6iba3v